What it means

We couldn’t authenticate the request. Either there’s no Authorization header, the bearer token we saw doesn’t match anything we issued, it’s expired, or it’s been revoked.

Common causes & fixes

Distinguishing “expired” vs “revoked”

We don’t expose this in the detail for security reasons (you shouldn’t be able to probe which case you’re in to enumerate users). Treat them the same:
  1. Try a refresh. If it succeeds, you had a stale access token — store the new pair and retry the original request.
  2. If the refresh itself returns invalid_grant, the user has either disconnected or your refresh token has expired (90-day TTL). In either case, you need to send the user through the authorize flow again.